search

jaredhendrickson13 / pfsense-saml2-auth

A SAML2 authentication extension for the pfSense UI
Apache License 2.0
49 stars 7 forks source link

SAML2 extension not compatible with certain system patches #15

Closed michaelw closed 2 years ago

michaelw commented 2 years ago

Hi, in pfsense 2.6.0-RELEASE, the User Manager -> Settings tab, throws a php error if the below mentioned patch is installed, via this package: https://docs.netgate.com/pfsense/en/latest/development/system-patches.html. The patch also does not cleanly revert after then installation of the package.

Add user preference to choose password hash algorithm (Redmine #12855)

Fix: uninstall pfsense-saml2-auth, then revert patch, then reinstall pfsense-saml2-auth.

jaredhendrickson13 commented 2 years ago

Hey!

Yes, this would be expected behavior for any manual patch or live patch that makes changes to /etc/inc/auth.inc, /etc/inc/authgui.inc, or /etc/inc/priv.inc. This package overrides these files with versions that include the additional SAML2 code that is required. This is dependent on those files being in the state they were when the pfSense version was initially released, otherwise references to the changed code may cause errors throughout pfSense. Depending on the order the package was installed, this would also prevent the package from correctly uninstalling as the package will simply restore the version of the file that was present when the package was initially installed. Possibly reverting at least a part of the patch.

To make the package work with patched version of those files, you would need to do a diff on those files and merge the changes between the two which is a manual process. Otherwise, such patches are typically included in the next pfSense release which this package will accommodate for at that time. This isn't explicitly mentioned in the documentation so I'll add a snippet about certain patches breaking compatibility.

Thanks!